Attacks/Breaches
1/2/2014
07:38 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Snapchat To Update App In Wake Of Breach

App vendor planning new version that lets users opt out of appearing in beleagured 'Find Friends' feature

Snapchat, a mobile photo-messaging app created for wiping out traces of the messages for privacy reasons, this week was hit with a major breach of its users' privacy that exposed names and phone numbers of some 4.6 million of its customers. The data dump came after security researchers published a proof-of-concept for a weakness associated with the "Find Friends" feature.

The app provider late today announced that it would update Snapchat to better protect its users. "We will be releasing an updated version of the Snapchat application that will allow Snapchatters to opt out of appearing in Find Friends after they have verified their phone number. We’re also improving rate limiting and other restrictions to address future attempts to abuse our service," Snapchat said in a blog post.

Snapchat also said researchers could email the firm at security@snapchat.com for any vulnerability discoveries. "We want to make sure that security experts can get a hold of us when they discover new ways to abuse our service so that we can respond quickly to address those concerns. The best way to let us know about security vulnerabilities is by emailing us: security@snapchat.com," Snapchat said.

The blog post came in response to criticism by the researchers who first reported and then published details on the flaw in Snapchat's app after saying they had not gotten a response from Snapchat. A hacker group yesterday exploited the flaw and posted online to a site called SnapchatDB the names and phone numbers, with the final two digits obscured, on some 2.6 million Snapchat users.

"As much as we were hoping it wouldn't be exploited, we did expect at least something to come of it. We don't condone the Snapchat DB leak, and feel that it's a pretty reckless way to get across the point to Snapchat," researchers at Gibson Security told Dark Reading in an email interview.

The researchers say they tried to contact Snapchat in August electronically before their original post about the flaw. On Dec. 27, Snapchat posted a blog basically dismissing the vulnerabilities. "This week, on Christmas Eve, a security group posted documentation for our private API. This documentation included an allegation regarding a possible attack by which one could compile a database of Snapchat usernames and phone numbers," Snapchat said in that post. "Theoretically, if someone were able to upload a huge set of phone numbers, like every number in an area code, or every possible number in the U.S., they could create a database of the results and match usernames to phone numbers that way. Over the past year we’ve implemented various safeguards to make it more difficult to do. We recently added additional counter-measures and continue to make improvements to combat spam and abuse."

Find Friends basically lets users upload their contacts list to Snapchat so that Snapchat can display the accounts of users that match those phone numbers.

Gibson Security said Snapchat's director of operations contacted them via email, but that they hadn't heard anything since then as of this morning.

The breach of user information is another example of the risks associated with many mobile apps today, security experts say. "In a rush for growth, companies often put security on the back burner. Snapchat here is no exception. What we see here is a classic example of how the intersection of social media, mobile platforms, and cloud create new entry doors for the hackers to exploit. Today’s rapid moving parts and the plethora of connections make it all too easy for the attackers," says Bala Venkat, CMO at Cenzic.

Kevin O’Brien, director of product marketing at CloudLock, says this low bar of entry into the mobile app space basically complicates security. The Snapchat customer data dump has damage potential to the users, he says.

"Spoofed phone calls" are one potential abuse, he says, as well as criminals using the phone numbers, geographic information, and usernames for identity theft or to escalate victims' user privileges elsewhere. "PII [personally identifiable information] is valuable. It allows you to get closer to the target," O'Brien says.

Gibson Security, meanwhile, suggests users delete their Snapchat accounts or contact their mobile phone network providers to change their phone numbers if they are especially concerned those numbers could be fully discerned by prospective attackers. "They should definitely ensure their security and privacy settings are up to date and well adjusted in all their social media accounts. Users should perform due diligence when registering for new social media accounts -- if a site doesn't deserve [or shouldn't have] your phone number, don't give it to them," the researchers say.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9676
Published: 2015-02-27
The seg_write_packet function in libavformat/segment.c in ffmpeg 2.1.4 and earlier does not free the correct memory location, which allows remote attackers to cause a denial of service ("invalid memory handler") and possibly execute arbitrary code via a crafted video that triggers a use after free.

CVE-2014-9682
Published: 2015-02-27
The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.

CVE-2015-0655
Published: 2015-02-27
Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184.

CVE-2015-0884
Published: 2015-02-27
Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.

CVE-2015-0885
Published: 2015-02-27
checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.